31bbfa06d8731d24840339a0e5d6a7609411ffa92ef9ea6ae634e6a78cd900b8 | Triage

Analysis

max time kernel
1406s
max time network
1172s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
11/10/2024, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

png2jpg.zip
Size

70KB
MD5

16f0ada7b5a3c6c862e4247d4f6c9434
SHA1

b3e6afb9f2ab5af7392aeb64e43e3b65e3ad27fb
SHA256

31bbfa06d8731d24840339a0e5d6a7609411ffa92ef9ea6ae634e6a78cd900b8
SHA512

10b021617b32d1bc3d46ad32ca657edb64330d229a85d2d40b1b962ed77317c3dece6a276b52e46a4e12da607b0099cae765f5498ad18cca20e3403b7f50007b
SSDEEP

1536:q1OifrbD8iK2KXyIPTAGwTVh6b+MqlY7JcnZcwjAYKTFD2:qjQinEu4+S1cndKV2

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3852	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3852	7zFM.exe
Token: 35	3852	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3852	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\png2jpg.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads